Jump to content
Tuts 4 You
wwh1004

A better way to dump .NET assembly packed by a native stub

Recommended Posts

wwh1004
Posted (edited)

I once post it in a China forum, you can visit it in https://www.52pojie.cn/thread-762832-1-1.html by Google Translator

I try my best to introduce it using English

1. download x64dbg and download the symbol file of clr.dll (mscorwks.dll if runtime is .net2.0~.net3.5)

2.set a breakpoint at "SystemDomain::ExecuteMainMethod" in clr.dll/mscorwks.dll and run

3.use MegaDumper (I use my ExtremeDumper based on codecracker's megadumper:D https://github.com/wwh1004/ExtremeDumper) to dump the main module when the program break at "SystemDomain::ExecuteMainMethod"

4.fix pe header and maybe you shoud also fix .net header

This way is more complex than use MegaDumper only and directt dump the assembly. But if the assembly is packed with native stub and protected with anti dump (ConfuserEx and others) or protected with whole #US encryption (DNGuardHVM and others), maybe this way is good to dump assemblies.

If you can not understand it, you can reply me.:)

Best wish.

Edited by wwh1004 (see edit history)
  • Like 2
  • Thanks 1

Share this post


Link to post
Keosoft90

@wwh1004 : can you add 2 tools to here ?

Share this post


Link to post
Black Hat Anonymous

There is a Script of OLLYDBG made by @GIV that also helps to unpack the Anti Dump protected .NET Files and newbie Friendly too.
But this method I tested and works well which you described.
Very nice Explanation too. Thank you !!! 

Share this post


Link to post
mdj
Posted (edited)

@wwh1004 please share video on other server i cannot download from pan.baidu

Edited by mdj (see edit history)

Share this post


Link to post
mdj

@kao:worthy: thank you very very much for this if you have time please upload second video 

Best Regards

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...